JP2002358216A - Computer monitoring system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a computer monitoring system that performs monitoring for improving use efficiency in a computer of a monitoring object, and also finds unauthorized mail transmission and reception, unauthorized browsing, etc., which have been unable to discriminate until now, to promote the authorized use of the computer in the network system. SOLUTION: In the computer monitoring system, a monitoring object PC2 records a log of operating condition in application software. The monitoring PC1 acquires the log from the monitoring object PC2. The operating time and activity ratio for every application software except time in a idle state, and the time and activity ratio in a idle state, are calculated to display and output the utilization ratio.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a computer monitoring system for monitoring a computer, and more particularly to a computer capable of monitoring unauthorized use such as use efficiency of a monitored computer, e-mail, Internet browsing or software installation. Related to monitoring systems.

[0002]

2. Description of the Related Art Conventionally, there has been a system having a function of monitoring a computer connected to a network.
As such a system, Japanese Patent Application Laid-Open No. 8-263283, “Software Management System” published on October 11, 1996 (Applicant: Ricoh Co., Ltd.
Inventor: Hideki Kobayashi). The present invention provides a software management system that can be easily maintained and managed so that software programs are not illegally used by a plurality of terminal devices connected by communication means such as a LAN.

[0003]

However, in the above-mentioned conventional system, only the log of the computer to be monitored is monitored, and the use efficiency and unauthorized use of the computer to be monitored are positively determined. And the monitoring function is not fully utilized.

The present invention has been made in view of the above circumstances, and performs monitoring for improving the efficiency of use of a computer to be monitored, and prevents unauthorized mail transmission / reception, unauthorized browsing, and the like that could not be determined until now. It is an object of the present invention to provide a computer monitoring system for discovering and promoting proper use of computers in a network system.

[0005]

SUMMARY OF THE INVENTION The present invention for solving the above-mentioned problems of the prior art is a computer monitoring system in which a computer to be monitored records a log of the use status of application software, and the computer to be monitored is a computer to be monitored. From the computer, calculate the usage time and usage rate of each application software except the idle time, and calculate the idle time and usage rate and output the usage efficiency, and obtain the log of the monitored computer. In addition, the usage efficiency can be measured for each application software on the monitored computer.

According to the present invention, in the above-mentioned computer monitoring system, the monitoring computer can monitor a plurality of monitoring target computers, obtain logs of the plurality of monitoring target computers in the department for each department, and obtain an application for each department. It outputs the usage efficiency of software, and can measure the usage efficiency of application software for each department.

According to the present invention, in the above-described computer monitoring system, the monitoring computer acquires a log of characters input by the monitoring target computer, and determines whether an unauthorized document is created by the monitoring target computer. Analysis, to suppress unauthorized document creation,
Proper use of the monitored computer can be encouraged.

According to the present invention, in the above-mentioned computer monitoring system, the monitoring computer acquires a log of the contents of mail transmission / reception at the monitored computer, and analyzes whether or not unauthorized mail transmission / reception has been performed at the monitored computer. To prevent unauthorized sending and receiving of emails,
Proper use of the monitored computer can be encouraged.

According to the present invention, in the above-mentioned computer monitoring system, the monitoring computer acquires a log of browsing on the monitored computer on the Internet, and analyzes whether or not unauthorized browsing has been performed on the monitored computer. Thus, unauthorized browsing can be suppressed, and proper use of the monitored computer can be promoted.

According to the present invention, in the above-mentioned computer monitoring system, the monitoring computer acquires a log of software installation or uninstallation on the monitored computer, and unauthorized software installation or uninstallation is performed on the monitored computer. This is to analyze whether or not there is any, and it is possible to suppress installation or uninstallation of unauthorized software and to promote proper use of the monitored computer.

According to the present invention, in the above-mentioned computer monitoring system, the monitoring computer acquires a log of the input characters on the monitored computer, calculates the number of input characters, and calculates the input efficiency with respect to the usage time of the software on the monitored computer. It can evaluate the input efficiency of the user of the monitored computer.

According to the present invention, in a computer monitoring system, a monitored computer holds a homepage access log, the monitored computer obtains a log from the monitored computer, and counts access time to each homepage in a specific counting period. Lists URLs or names of websites in order of access time,
You can easily find popular sites.

According to the present invention, in a computer monitoring system, a monitored computer holds a log of the use status of application software, the monitored computer acquires a log from the monitored computer, and a ratio of idle time to usage time of the application software. The operating rate is calculated from the above, and the monitored computers are displayed in a list in the order of the operating rates, so that the monitored computers with high or low operating rates can be easily known.

According to the present invention, in a computer monitoring system, when a monitored computer holds a log of site browsing, the monitored computer acquires a log from the monitored computer, and the log is related to a site registered in advance, the site is monitored. The number of times or time of browsing is totaled for each, the browsing rate is calculated based on the number or time of browsing, and the names of the monitored computers are displayed in a list in order of the browsing rate. The browsing rate can be easily known.

According to the present invention, in a computer monitoring system, a monitored computer holds a log of the use status of application software, the monitored computer acquires a log from the monitored computer, and the log is related to previously registered application software. In this case, the number of times or time of use is totaled for each application software, the usage rate is calculated based on the number or time of use, and the names of the monitored computers are displayed in a list in the order of usage rate. The usage rate of the monitored computer in the software can be easily known.

According to the present invention, in a computer monitoring system, a monitored computer holds a log of the use status of application software or an access to a homepage, and classifies application software used by the monitoring computer or a homepage to be accessed into specific items in advance. The log is obtained from the monitored computer, the usage time and browsing time for each category are calculated, and the names of the monitored computers are displayed in a list according to the ratio of specific items. Can be easily known.

According to the present invention, in a computer monitoring system, a monitored computer holds a log of input characters when using application software, the monitoring computer acquires a log from the monitored computer, and displays the input characters for each application software. And
Input characters can be easily known for each application software.

According to the present invention, in a computer monitoring system, the monitored computer holds a log of the use status of the application software, the monitoring computer classifies and registers the application software in advance, and logs from the monitored computer. Obtain and summarize the usage time in each category and the usage time in all categories, calculate the usage rate of a specific category in all categories, and display the usage rate. Each category to which the application belongs The usage rate for the whole can be easily known.

According to the present invention, in a computer monitoring system, a monitored computer holds a log of the browsing status of a site, the monitored computer classifies the site in advance and registers the site, and acquires a log from the monitored computer. , The browsing time in each category and the browsing time in all categories are totaled, the browsing rate of a specific category is calculated in all categories, and the browsing rate is displayed.
The browsing rate for each category to which the site belongs can be easily known.

[0020]

Embodiments of the present invention will be described with reference to the drawings. In a computer monitoring system according to an embodiment of the present invention, a computer (monitoring PC) that performs monitoring is a computer to be monitored (monitoring target P).
C) Acquires the log of the action, and calculates and displays the usage efficiency of the monitored PC using the log. In particular, the operation based on the active time excluding the idle time of the business application in the monitored PC is performed. It is possible to calculate the time, measure the usage efficiency of the application software on the monitored PC, and improve the usage efficiency.

Further, the computer monitoring system according to the embodiment of the present invention monitors an illegal transmission / reception of an electronic mail, an illegal browsing on the Internet, and promotes proper use of a computer on a network.

A computer monitoring system (this system) according to an embodiment of the present invention will be described with reference to FIG. FIG. 1 is a configuration block diagram of a computer monitoring system according to an embodiment of the present invention. This system is 1
A one-to-one, one-to-many, or many-to-many LAN connection computer system, as shown in FIG. 1, a monitoring computer (monitoring PC) 1 for monitoring, and a monitoring target computer monitored by the monitoring PC 1 (Monitored PC) 2
a, 2b, and 2c, and a LAN 3 that connects the monitoring PC 1 and each monitoring target PC 2.

Here, the LAN 3 is a wired connection, but may be a wireless LAN of a wireless connection. Also,
Normally, the monitoring PC 1 is used by a supervisor in a company and a teacher in a school, and the monitoring target PC 2 is used by subordinates in a company,
It can be used by students at school.

Next, each section in the present system will be specifically described. The monitoring PC 1 is a monitoring target PC 2 connected to the LAN.
Is a PC for monitoring. Management software for monitoring is installed in the PC 1, and the monitoring target P
In addition to the normal log (recording of action and time) in C2, a new log such as character input is acquired and these data are displayed, and the usage efficiency of the monitored PC 2 is calculated and displayed from the normal log. In addition, it detects unauthorized transmission / reception of an electronic mail, unauthorized browsing, and the like from a log of characters and the like.

As shown in FIG. 1, the monitoring PC 1 monitors each of a plurality of monitoring target PCs 2a, 2b, and 2c, and monitors a plurality of monitoring target PCs in a specific group (for each department).
2 are collectively monitored, and the usage status of the application in a specific group unit is also analyzed. A specific monitoring method in the monitoring PC 1 will be described later.

The monitoring target PC 2 is connected to the LAN 3 and has monitoring software installed by the monitoring PC 1 installed. For example, the following logs are obtained using TELNET. Log contents include application active / idle, e-mail transmission / reception log (e-mail content is also obtained as text), character input log (text data is obtained as text), software installation / uninstallation log, Internet and intranet This is a browsing log or the like. Naturally, the date and time are acquired at the same time in these logs.

The LAN 3 comprises a monitoring PC 1 and a monitoring target PC 2
a is a network that connects a to 2c, and includes a wired or wireless connection, or a wired and wireless connection. Also, monitoring P with management software installed
C1 is a monitoring target P on which monitoring software is installed.
C2 is authorized to monitor, for example, the monitoring target PC 2
a has no authority to monitor the other monitored PC 2b.

Next, management software and monitoring software used in the present system will be described with reference to FIGS. FIG. 4 is a configuration diagram of the management software, and FIG. 5 is a configuration diagram of the monitoring software. As shown in FIG. 4, the management software 21 includes a control unit 22, a log acquisition unit 23, a log analysis unit 24, a data calculation unit 25, and a display unit 26. As shown in FIG. 5, the monitoring software 31 includes a control unit 32, a log output unit 33, and a plurality of monitoring units 34.

Next, the configuration of each means of the management software 21 will be specifically described. The control means 22 includes the management software 21
Is a means for controlling each operation in. Control means 22
Sends a log acquisition command to the monitoring target PC 2
The data is output via the AN 3, and a data operation command relating to the log is output to the data operation means 25. Further, control means 22
Outputs a display command for displaying the log acquired by the log acquisition unit 23 or the data operation result calculated by the data operation unit 25 to the display unit 26. Here, the output of the log acquisition command may be performed when a log acquisition instruction is input from a user of the monitoring PC 1 or may be automatically performed at a fixed time.

The log obtaining means 23 obtains the log output from the monitoring target PC 2 in response to the log obtaining instruction from the control means 22, and stores the log in the memory unit (not shown) of the management PC 1.

The log analysis means 24 analyzes the log stored in the memory unit, determines and classifies the type of the log,
It is stored in another area of the memory unit.

The data calculation means 25 is composed of the log analysis means 24
The desired data is calculated based on the data operation command output from the control unit 22 using the log classified and stored according to the type, and the calculated data is stored in another area of the memory unit.

The display means 26 is a log or data calculation means 2 for each type classified and stored by the log analysis means 24.
5 is displayed in accordance with the display command of the control means 22.

Next, the configuration of each means of the monitoring software 31 will be specifically described. The control means 32 includes the monitoring software 31
Is a means for controlling each operation in. Control means 32
When detecting a log acquisition instruction output from the management software 21, the log output instruction is output to the log output unit 33.

The log output means 33 collectively transmits each type of log recorded by each monitoring means 34 to the monitoring PC 1 based on a log output command from the control means 32. Further, the log output unit 33 deletes the output log from a memory unit (not shown) of the monitored PC 2.

A plurality of monitoring means 34 are provided for each application to be monitored, such as applications and mails, and monitor the corresponding application to be monitored all the time, and store the monitoring result as a log in the memory section of the PC 2 to be monitored. I do.

Next, monitoring processing in the present system will be described with reference to FIGS. FIG. 2 is a schematic diagram showing a log display screen of the monitoring target PC 2 on the monitoring PC 1, and FIG. 3 is a schematic diagram showing a display example of the usage efficiency on the monitoring target PC 2. FIG. 6 is a flowchart of a log acquisition operation in the management software, and FIG. 7 is a flowchart of a data calculation operation in the management software.
5 is a flowchart of a log output operation in the monitoring software.

When the monitoring PC 1 outputs an instruction to obtain a log to a specific monitoring target PC 2 via the LAN 3, the monitoring target PC 2 transmits the recorded log to the monitoring PC 1 via the LAN 3.

Specifically, first, in the monitoring PC 1, the control means 32 of the management software 21 outputs and transmits a log acquisition command to a specific monitoring target PC 2 via the LAN 3.
In the monitoring target PC 2, the monitoring means 34 provided for each application to be monitored records the log all the time (S31 in FIG. 8).

When the log acquisition command is received by the monitored PC 2 (YES in S32 of FIG. 8), the control unit 32
Detects a log acquisition instruction and outputs a log output instruction to the log output means 33. If the log acquisition command is not received (NO in S32 of FIG. 8), the monitoring target P
In C2, each monitoring unit 34 continues to record a log.

The log output means 33 reads the log recorded by each monitoring means 34 based on the log output command,
The data is collectively output and transmitted to the monitoring PC 1 via the AN 3 (S33 in FIG. 8). The read log is deleted from the memory unit by the log output unit 34 (S3 in FIG. 8).
4).

Next, the monitoring PC 1 obtains the log transmitted from the monitoring target PC 2, analyzes the obtained log, and classifies the log for each monitoring target or set item. Specifically, the log acquisition unit 23 of the management software 21 in the monitoring PC 1
It is determined whether or not a log acquisition command is output from the control unit 22 (S11 in FIG. 6). If the log acquisition command is output (YES in S11 in FIG. 6), the transmitted log is acquired. (S12 in FIG. 6). The acquired log is stored in the memory unit of the monitoring PC 1.

Next, the log analysis means 24 analyzes the obtained log, classifies it by the application to be monitored or each set item, and stores it in the memory unit (S1 in FIG. 6).
3). Since the acquired log is a set of logs recorded by the plurality of monitoring units 34 in the monitoring software 31, it is possible to efficiently compile or collect logs by classifying in advance each application to be monitored or each set item. Display can be performed. The log analysis unit 24 analyzes the acquired log to determine which application to be monitored is a log, identifies the type of log, and stores the identified log in the memory unit for each type.

Finally, the log whose analysis has been completed is displayed on the display means 2.
6 (S14 in FIG. 6). Hereinafter, a log display method will be described using an example of a display screen. The monitoring PC 1 displays the acquired log of the monitoring target PC 2 as shown in the display screen of FIG. Specifically, when the monitoring PC 1 starts up the management software 21, the display unit 25 displays a screen including the calendar unit 11, the connection state display unit 12, and the log display unit 13. However, when the management software is started, the monitoring target PC 2 is not specified, and thus the log display unit 13 is in a state where the contents are not displayed.

When the monitoring target PC 2 is specified by referring to the connection status display unit 12 on the display screen of the monitoring PC 1 in a state where the log of the monitoring target PC 2 has been obtained and classified by the above-described method, the control means 22 executes the display command. Is output to the display means 26. Here, the display command includes information such as the type and order of logs to be displayed. The display unit 26 displays the log contents of the monitored PC 2 on the log display unit 13 based on the display command. The display unit 25 displays the classified logs. For example, when a new log has not been obtained (NO in S11 of FIG. 6), the obtained and classified logs stored in the memory unit are displayed. indicate.

The log contents displayed on the log display unit 13 are as follows:
These are the event type, date and time, and parameters, and "character input" is included in the event type. Although not shown in FIG. 2, the acquired logs include a log of mail transmission / reception, a log of software installation and uninstallation, a log of browsing, and the like.

Therefore, since the monitoring PC 1 can obtain the text input and the contents of the mail transmission and reception from the monitoring target PC 2 as text, the monitoring PC 1 analyzes the text to create an illegal document and an illegal mail transmission and reception. Can be checked.

Further, since the monitoring PC 1 can acquire the installation and uninstallation of the software of the monitoring target PC 2 from the log, it is possible to check the installation of the unauthorized software and the uninstallation of the appropriate software.

Further, since the monitoring PC 1 can obtain a character input from the monitoring target PC 2 as text, even if it is application software such as sticky note software, the monitoring PC 1 obtains the character text to be input therefrom. The contents can be analyzed. In addition, the monitoring PC 1
Since the browsing log is acquired from C2, it can be easily checked whether or not the user accesses a predetermined regular homepage.

In the display screen of FIG.
When the monitoring target PC 2 is specified by referring to the connection status display unit 12 in a state where the acquisition and the classification of the log from the PC have not been completed, the management software 21 performs the acquisition and the classification of the log described above, and displays the log on the display screen. The specification may be such that

Further, the monitoring PC 1 calculates the usage efficiency of various application software from the log contents shown in FIG. When an instruction to calculate and display the usage efficiency is input on the screen in FIG. 2, the usage efficiency as shown in FIG. 3 is displayed.

More specifically, when an instruction to calculate and display the usage efficiency is input, the control unit 22 of the management software 21 outputs a data operation instruction to the data operation unit 25. When detecting that the data operation command has been output (YES in S21 of FIG. 7), the data operation unit 25 performs an operation for obtaining data of the usage efficiency using the classified logs (S22 of FIG. 7). Finally, the control unit 22 outputs a display command to the display unit 26, and the display unit 26 displays the data of the usage efficiency on the display screen (S23 in FIG. 7).

In FIG. 3, the usage time and the usage rate are calculated and displayed for the application contents. The usage time for each application is calculated as the actual usage time excluding the idle time in the application. Specifically, the usage time is
It is measured from the time when the application is active, and is a time until the end of the application, for example, after a lapse of 5 minutes from an action such as start-up or character input and subtracting a time (idle time) until the next action. That is, it is a substantial application use time. In FIG. 3, the idle is displayed as "IDLE".

The usage rate is obtained by calculating and using the percentage used in all applications and idles. Here, the usage time and usage rate of the day are displayed, but weekly or monthly totalization is also possible. At this time, it is necessary for the monitoring PC 1 to be able to store logs for the total time in the memory unit.

In addition to managing the use of personal PCs, it is also possible to collectively display and display the use states of the applications for each section such as the accounting department, the design department, and the sales department. Specifically, by calculating the use order, the average, and the like of the applications for each department, it is possible to promote business improvement in each department.

For example, assuming that the use of a spreadsheet application is more frequent than the use of a CAD application for design based on the tabulation results of the design department, the work of estimating and the like in the design department is more than the work of design. Improvement proposals can be made to shift jobs such as estimation to another department.

The monitoring PC 1 can also obtain the number of character inputs from the log of character input on the PC 2 to be monitored, and calculate the input efficiency based on the number of characters input during the usage time of the application. As a result, the monitored PC
2, the input efficiency of the user can be measured, which can be useful for the user's personnel considerations.

In a corporate intranet, if the personal computer is constantly turned on, the idle time increases. In this case, the network connection time and the logoff time are used as a reference. Calculate application usage efficiency within
Will be displayed.

The above-described calculation of each efficiency value is performed by the control unit 22.
And outputs a data operation instruction to calculate the corresponding efficiency value to the data operation means 25.

According to the computer monitoring system (this system) according to the embodiment of the present invention, the monitoring PC 1 acquires the log in the monitoring target PC 2 and calculates and displays the usage efficiency for each application. It is possible to easily and appropriately determine whether or not the application software is being used appropriately and efficiently in each monitored PC 2, and this has the effect of promoting business improvement in the monitored PC 2.

According to the present system, the monitoring PC 1
Since the use status of application software for each department can be tabulated from the logs of the PCs 2 to be monitored, the proper use of application software in each department can be determined, and there is an effect that business improvement can be easily performed.

According to the present system, the monitoring PC 1
Can obtain the contents of mail transmission / reception at the monitoring target PC 2, so that the contents of the mail can be easily analyzed, and there is an effect that unauthorized mail transmission / reception can be eliminated.

According to the present system, the monitoring PC 1
Since it is possible to grasp the browsing log and homepage browsing time on the monitored PC 2, there is an effect that unauthorized browsing on the Internet can be eliminated.

According to the present system, the monitoring PC 1
Can obtain a log of software installation and uninstallation on the PC 2 to be monitored, so that there is an effect that proper software installation can be prompted.

Next, first to eighth examples of another method of use in the present system will be described. First, a first usage method is to display a “popular site list”. The computer to be monitored (PC to be monitored) is an individual, a department, and a computer as a whole, and a list of homepages is displayed in the order of access time in units of days, weeks, months, and years for a totaling period.

Specifically, the monitoring target PC holds a log relating to homepage (site) access, and the monitoring computer (monitoring PC) obtains a log relating to homepage access in the monitoring target PC from each monitoring target PC and classifies it. Stored in the memory unit. Then, in the management software 21 of the monitoring PC, a data calculation instruction for accumulating (counting) the access time for each homepage accessed in the counting period unit is output from the control means 22 to the data calculation means 25 to perform the calculation. Let The control means 22
Outputs a display instruction to display the URL of the homepage or the name of the homepage in a list in the descending order of the accumulated access time to the display means 26 to display the display.
This makes it possible to easily find a site that is popular in business.

The second method of use is to display a “PC (employee) list in order of operating rate”. The PC to be monitored is a department, the entire computer, and the totaling period is in units of days, weeks, months, and years, and a list of PCs with low or high usage rates is displayed based on the ratio of idle time to normal business hours.

Specifically, the monitoring target PC holds a log of the usage status of the business application, and the monitoring PC
Acquires the log of the usage status of the business application software in the monitored PC from each monitored PC, classifies the log, and stores it in the memory unit. Then, the management software 21 of the monitoring PC accumulates the idle time of each monitored PC and the usage time of the normal business, and calculates the operation rate (usage rate) = (the usage time of the normal business) / (idling time). From the control means 22 to the data operation means 2
5 to perform an operation. Further, the control means 22 includes:
A display command to display the names of the PCs to be monitored as a list in the order of the operation rates is output to the display means 26 and displayed. As a result, a PC with a high or low operating rate can be easily known.

The third usage method is “site (category)”.
Another PC (employee) list "is displayed. The PCs to be monitored are departments and the entire computer.
The list is displayed in the order of the browsing rate of a specific site (category), with the unit of month and year.

Specifically, the monitoring PC sets a specific site or a site belonging to a specific category in advance,
The log of the accessed site in the monitoring target PC is acquired from each monitoring target PC, classified, and stored in the memory unit. Then, in the management software 21 of the monitoring PC, the control unit 22 and the data calculation unit 25 calculate the number of browsing times or browsing times for the set site, and further, based on the calculated number of browsing times or browsing times, all the set browsing times or times. The browsing rate of a specific site is calculated using the number of times or time of browsing to the site as a denominator. Thereafter, the control unit 22 and the display unit 26 display a list of the names of the PCs to be monitored in order from the highest or the lowest browsing rate of the specific site. Thereby, the browsing rate of each monitoring target PC at a specific site (category) can be easily known.

A fourth method of use is to display a “PC (employee) list by application (category)”. The PC to be monitored is a department and the entire computer, and the totaling period is displayed in the order of the browsing rate of a specific application (category) in units of day, week, month, and year.

Specifically, the monitored PC holds a log of the application, and the monitored PC sets a specific application or an application belonging to a specific category in advance, and logs the used application in the monitored PC. Is obtained from each PC to be monitored, classified, and stored in the memory unit. Then, in the management software 21 of the monitoring PC, the control means 22 and the data calculation means 2
5 calculates the usage count or usage time for the set application, and further, based on the calculated usage count or usage time, uses the usage count or usage time for all of the set applications as the denominator to use the specific application. Is calculated. After that, the control unit 22 and the display unit 26 list the names of the monitoring target PCs in the order of higher or lower usage rate. Thus, the usage rate of each monitored PC in a specific application (category) can be easily known.

The fifth method of use is to display a “PC (employee) list in order of power”. The PC to be monitored is a department and the entire computer. The totaling period is in units of days, weeks, months, and years. The application and the homepage are set to work or play, the application usage time, the site visit. From time, "work", "play", "idol",
It is classified into four items of "unknown". A list of PCs is displayed according to the ratio of the classified items.

More specifically, the monitoring PC preliminarily sorts the above-mentioned specific items in the application, the site, and the like, and logs the application used in the monitoring target PC and the log of the browsed site from each monitoring target PC. It is acquired, classified, and stored in the memory unit. Then, in the management software 21 of the monitoring PC, the control unit 22 and the data calculation unit 25 calculate the usage time and the browsing time for each item, and further, for each monitoring target PC, the power rate = (total time of “work” classification) Calculate the power by // (total time of all categories). After that, the control unit 22 and the display unit 26
A list of the names of the PCs to be monitored is displayed in the order of higher or lower power. Similarly, the "play rate", "idle rate", and "unknown rate" can be obtained. Thereby, the order of the power (the ratio of the specific item) can be easily known.

The sixth method of use is to display an “input character list for each application”. The PC to be monitored is a personal computer, and the totaling period is in days and the characters input for each application are displayed.

Specifically, the monitoring PC obtains a log of the input characters of the monitored PC by the above-described method, classifies the logs, and stores the input characters in the memory unit corresponding to the application. The control unit 22 and the display unit 25 select and read input characters for each application, and display a list of input characters for each application. Previously, characters were displayed in all applications,
Thus, the contents of the input characters can be easily known for each application.

A seventh use method is a display of “application category usage rate”. The PCs to be monitored are individuals, departments, and the entire computer. The counting period is day, week,
Categories are registered in the application in units of months and years, and the usage rates of the applications are totaled and displayed for each category. This is not a conventional method of totalizing the usage rate of a specific word processing software in an application, but totaling the usage rate in a category of word processing software.

More specifically, the monitoring PC sets the applications in advance by classifying them into categories, and obtains the control means 22 and the data calculation means from the log of the use status of the applications obtained and classified from each monitoring target PC. 25 accumulates the usage time for each category, and obtains the application category usage rate = (cumulative usage time for each category) / (cumulative usage time for all categories), and the control means 22 and the display means 26 display. As a result, it is possible to easily know the usage rate of each category to which the application belongs with respect to the entire category.

The eighth usage method is a “site category browsing rate” display. The PC to be monitored is an individual, a department, and the entire computer. The totaling period is in units of day, week, month, and year. A category is registered for each URL, and the browsing rate is displayed in the category. In the conventional method, it is possible to know which pages and how many pages have been viewed, but in this usage method, the A search site and the B search site are displayed collectively on one search site.

More specifically, the monitoring PC sets a category in advance for the URL, obtains a log of site browsing of each monitoring target PC, classifies the log, and executes the control unit 22 and the data calculation unit 25. Accumulates browsing time for each category,
Site category browsing rate = (cumulative browsing time for each category)
/ (Accumulated browsing time of all categories)
And the display means 26 displays the category browsing rate. As a result, the browsing rate for the entire category to which the site belongs can be easily known.

[0081]

According to the present invention, the monitored computer obtains a log of the usage status of the application software,
The monitoring computer acquires the log from the monitored computer, calculates the usage time and usage rate of each application software except the idle time, and calculates the idle time and usage rate, and outputs the usage efficiency. In addition to obtaining the log of the monitored computer, the usage efficiency of each application software in the monitored computer can be measured, and the proper use of the application software in the monitored computer can be promoted.

According to the present invention, the monitoring computer is capable of monitoring a plurality of monitored computers, acquires logs of the plurality of monitored computers in the department for each department, and uses the application software for each department in terms of efficiency of use. Is output, the use efficiency of the application software can be measured for each department, and there is an effect that the business can be improved for each department.

According to the present invention, the monitoring computer obtains a log of the characters input by the monitoring target computer, and analyzes whether the monitoring target computer has created an unauthorized document. The monitoring system suppresses unauthorized document creation,
This has the effect of encouraging proper use on the monitored computer.

According to the present invention, the monitoring computer acquires a log of the contents of mail transmission / reception at the monitored computer, and analyzes whether or not unauthorized mail transmission / reception has been performed at the monitored computer. Because it is a system, it suppresses unauthorized mail transmission and reception,
This has the effect of encouraging proper use on the monitored computer.

According to the present invention, there is provided the computer monitoring system in which the monitoring computer obtains a log of browsing on the Internet at the monitored computer and analyzes whether or not unauthorized browsing has been performed on the monitored computer. Therefore, there is an effect that unauthorized browsing can be suppressed and proper use of the monitored computer can be promoted.

According to the present invention, the monitoring computer obtains a log of software installation or uninstallation on the monitored computer, and determines whether unauthorized software has been installed or uninstalled on the monitored computer. The above-mentioned computer monitoring system for analyzing computer programs has the effect of preventing installation or uninstallation of unauthorized software and promoting proper use of the monitored computer.

According to the present invention, the monitoring computer obtains a log of input characters at the monitored computer, calculates the number of input characters, and calculates the input efficiency with respect to the software usage time at the monitored computer. Since the system is used, the input efficiency of the user of the computer to be monitored can be evaluated, and there is an effect that it can be used for personnel considerations.

According to the present invention, the monitored computer holds a homepage access log, the monitored computer acquires the log from the monitored computer, counts the access time to each homepage in a specific counting period, and determines the access time. Because it is a computer monitoring system that displays a list of URLs or names of homepages in the longest order,
There is an effect that a popular site can be easily known.

According to the present invention, the monitored computer holds a log of the use status of the application software, the monitored computer acquires the log from the monitored computer, and determines the operating rate from the ratio of the idle time to the usage time of the application software. Is calculated, and the names of the monitored computers are displayed in a list in the order of the operating rates. Therefore, there is an effect that the monitored computers having high or low operating rates can be easily known.

According to the present invention, the monitoring target computer holds the log of the site browsing, the monitoring computer acquires the log from the monitoring target computer, and when the log is related to the site registered in advance, the monitoring is performed for each site. The number of times or time of the browsing, the browsing rate is calculated based on the number or time of the browsing, and a computer monitoring system that lists the URL or name of the site in the order of the browsing rate. The effect is that the browsing rate can be easily known.

According to the present invention, when the monitored computer holds a log of the use status of the application software, the monitored computer acquires the log from the monitored computer, and when the log is related to the application software registered in advance, The computer monitoring system aggregates the number of times or time of use for each application software, calculates the usage rate based on the number or time of use, and displays a list of monitored computers in order of usage rate. There is an effect that the usage rate of the monitored computer in the software can be easily known.

According to the present invention, the computer to be monitored keeps a log of the use status of the application software or the homepage access log, and the application software used by the monitoring computer or the homepage to be accessed is classified in advance into specific items, A computer monitoring system that obtains logs from the target computers, calculates the usage time and browsing time for each category, and lists the names of the monitored computers according to the ratio of specific items. There is an effect that can be easily known.

According to the present invention, there is provided a computer monitoring system in which a monitored computer holds a log of input characters when using application software, the monitoring computer acquires a log from the monitored computer, and displays the input characters for each application software. Because
There is an effect that input characters can be easily known for each application software.

According to the present invention, the monitored computer holds a log of the use status of the application software, the monitored computer classifies and registers the application software in advance, acquires the log from the monitored computer, The usage time in each category and the usage time in all categories are totaled, the usage rate of a specific category is calculated in all categories, and the computer monitoring system displays the usage rate. The effect is that the usage rate for the whole can be easily known.

According to the present invention, the monitored computer holds a log of the browsing status of the site, the monitoring computer classifies the site in advance and registers it, acquires the log from the monitored computer, and Since the browsing time in all categories and the browsing time in all categories are totaled, the browsing rate of a specific category is calculated in all categories, and the computer monitoring system displays the browsing rate.
There is an effect that the browsing rate for each category to which the site belongs can be easily known.

[Brief description of the drawings]

FIG. 1 is a configuration block diagram of a computer monitoring system according to an embodiment of the present invention.

FIG. 2 is a schematic diagram showing a log display screen of a monitoring target PC 2 in the monitoring PC 1.

FIG. 3 is a schematic diagram showing a display example of usage efficiency on a monitoring target PC 2;

FIG. 4 is a configuration diagram of management software used in the monitoring PC 1;

FIG. 5 is a configuration diagram of monitoring software used in a monitoring target PC 2;

FIG. 6 is a flowchart of a log acquisition operation in the management software.

FIG. 7 is a flowchart of a data calculation operation in the management software.

FIG. 8 is a flowchart of a log output operation in the monitoring software.

[Explanation of symbols]

1: Monitoring PC, 2: Monitoring target PC, 3: LAN,
11 calendar unit 12 connection status display unit 13
Log display unit, 21: management software, 22, 32: control means, 23: log acquisition means, 24: log analysis means,
25 ... data calculation means, 26 ... display means, 31 ...
Monitoring software, 33: log output means, 34: monitoring means

 ──────────────────────────────────────────────────続 き Continued on front page F term (reference) 5B042 GA12 GA36 JJ01 JJ46 KK13 LA19 MA08 MA14 MC29 MC33 MC40 NN04 5B085 AC05 AC12 AC14 AE00 BA07 BG07 5B089 GA11 GA21 GB03 HA06 KA17 KC47 MC03

Claims (15)

[Claims] 1. A computer monitoring system comprising: a monitoring computer that monitors a computer; and a monitoring target computer that is monitored by the monitoring computer, wherein the monitoring target computer obtains a log of usage status of application software. The monitoring computer acquires the log from the monitored computer, calculates and uses the usage time and usage rate of each application software except the idle time, and the idle time and usage rate. A computer monitoring system, which is a computer that outputs efficiency. 2. The monitoring computer is capable of monitoring a plurality of monitored computers, acquires logs of the plurality of monitored computers in a department for each department, and outputs the usage efficiency of application software for each department. The computer monitoring system according to claim 1, wherein the computer monitoring system is a computer. 3. The monitoring computer is a computer that acquires a log of input characters in the monitored computer and analyzes whether or not an unauthorized document has been created in the monitored computer. The computer monitoring system according to claim 1. 4. The monitoring computer is a computer that obtains a log of the contents of mail transmission / reception at the monitored computer and analyzes whether or not unauthorized mail transmission / reception has been performed at the monitored computer. The computer monitoring system according to claim 1 or 2, wherein 5. The monitoring computer is a computer that acquires a browsing log of the monitored computer on the Internet and analyzes whether or not unauthorized browsing has been performed on the monitored computer. The computer monitoring system according to claim 1. 6. The monitoring computer acquires a log of software installation or uninstallation on the monitored computer, and analyzes whether unauthorized software has been installed or uninstalled on the monitored computer. 3. The computer monitoring system according to claim 1, wherein the computer monitoring system is a computer. 7. The monitoring computer is a computer that acquires a log of input characters on the monitored computer, calculates the number of input characters, and calculates an input efficiency with respect to a use time of the software on the monitored computer. The computer monitoring system according to claim 1 or 2, wherein 8. A computer monitoring system comprising: a monitoring computer that monitors a computer; and a monitoring target computer that is monitored by the monitoring computer, wherein the monitoring target computer is a computer that holds a homepage access log. The monitoring computer is a computer that acquires the log from the monitoring target computer, totals the access time to each homepage in a specific counting period, and displays a list of the URLs or names of the homepages in descending order of the access time. A computer monitoring system. 9. A computer monitoring system comprising: a monitoring computer that monitors a computer; and a plurality of monitoring target computers that are monitored by the monitoring computer, wherein the monitoring target computer logs a usage status of application software. The monitoring computer, wherein the monitoring computer acquires the log from the monitoring target computer, calculates an operating rate from a ratio of an idle time and a use time of the application software, and monitors the monitoring target computer in the order of the operating rate. A computer monitoring system, which is a computer that displays a list of names of the computers. 10. A computer monitoring system comprising: a monitoring computer that monitors a computer; and a plurality of monitoring target computers monitored by the monitoring computer, wherein the monitoring target computer holds a site browsing log. The monitoring computer acquires the log from the computer to be monitored, and when the log is related to a site registered in advance, totals the number of times or time of browsing for each site, the number of times of browsing or A computer monitoring system, which is a computer that calculates a browsing rate based on time and displays a list of the names of the monitored computers in the order of the browsing rate. 11. A computer monitoring system comprising: a monitoring computer that monitors a computer; and a plurality of monitoring target computers that are monitored by the monitoring computer, wherein the monitoring target computer logs a usage status of application software. A computer that retains, the monitoring computer acquires the log from the monitored computer, and when the log is related to application software registered in advance, tabulates the number of times or time of use for each application software, A computer monitoring system, which is a computer that calculates a usage rate based on the number of times or time of use, and displays a list of the names of the monitored computers in order of the usage rate. 12. A computer monitoring system comprising: a monitoring computer that monitors a computer; and a plurality of monitoring target computers that are monitored by the monitoring computer, wherein the monitoring target computer uses application software or a homepage of a homepage. A computer that holds an access log, wherein the monitoring computer classifies application software to be used or a homepage to be accessed into specific items in advance, obtains the log from the monitored computer, and uses time in each of the classifications. A computer monitoring system that calculates browsing time and displays a list of monitored computer names according to the ratio of the specific items. 13. A computer monitoring system comprising: a monitoring computer that monitors a computer; and a monitoring target computer that is monitored by the monitoring computer, wherein the monitoring target computer records a log of input characters in using application software. A computer monitoring system, wherein the monitoring computer is a computer that acquires the log from the monitoring target computer and displays the input characters for each application software. 14. A computer monitoring system comprising: a monitoring computer that monitors a computer; and a monitoring target computer that is monitored by the monitoring computer, wherein the monitoring target computer holds a log of a usage status of application software. The monitoring computer is a computer, which classifies the application software in advance and registers the category, acquires the log from the monitoring target computer, and calculates the usage time in each category and the usage time in all categories. It is a computer that totals, calculates the usage rate of a specific category in all the categories, and displays the usage rate. 15. A computer monitoring system comprising: a monitoring computer that monitors a computer; and a monitoring target computer monitored by the monitoring computer, wherein the monitoring target computer holds a log of a site browsing status. The monitoring computer classifies sites in advance and registers them in categories, acquires the logs from the monitoring target computers, and tallies browsing time in each category and browsing time in all categories. A computer monitoring system which calculates a browsing rate of a specific category in all the categories and displays the browsing rate.